Dell Technologies Endpoint Security

So, uh, my name is Justin. I'm a principal security engineer and field CTO for Dell Technologies. Um, what I was asked to cover was specifically around, um, the Dell, uh, PC security capabilities and, and what that currently looks like and what our design philosophy is.

Um, I know we're gonna touch on it later, but what I will submit is, especially around our services piece, as a security practitioner, that is something that I rotate around quite a bit. Um, you're gonna hear more about that, uh, from, uh, Adam Miller, who's also on here with me, because there's some aspect of, uh, services and management in what we do from a, a client perspective. Uh, and then the other piece is when we start talking about, uh, our services and our ability to drive outcomes, that is completely technology agnostic, right?

So if a customer does not have, uh, Dell infrastructure in place and Dell hardware in place, uh, we still have our expertise as a technology company that we can provide to a client to drive security outcomes regardless of the products. Um, and we'll, we'll talk about that more, but I thought that that was a really good question. And just as a practitioner, um, I agree in that there's a lot of security products and a lot of technologies, but ultimately, security, uh, is, uh, an outcome, uh, based vocation, and you need policy and, and people for that as well.

So, uh, coming into specifically, uh, Dell's commercial pc, so the capabilities I'm gonna walk through today, by the way, are focused in on our commercial pc. Uh, so that would not be our consumer Inspiron or Alienware devices as much as we love those. Um, it's focused in on what was previously known as latitude or Precision, or under our new branding.

This would be the Dell Pro or Dell Pro Max. That's what we define as a commercial pc. And, uh, the first piece that we generally start with is, uh, why Dell as, uh, a subject matter expert from a cybersecurity perspective.

And so, for example, um, one of the items flashed up was the third party attestation from Principal Technologies. Um, you also saw, for example, uh, we were, uh, CrowdStrike's, uh, partner of the year before. Um, that CrowdStrike relationship is actually quite old.

Um, we've been working with them very closely since, uh, 2019. Um, and also one piece that I wanna call out here outside of our products and our services and the integration of our, uh, technology with other people's, uh, uh, uh, software and security solutions is, um, uh, Dell Technologies Capital, uh, and Dell Ventures. So if you're not familiar with that, Dell Technologies Capital is our venture capital arm of Dell.

And this is another superpower of Dell Technologies where we're able to find, uh, the next generation of security disruptors, uh, invest and help those entrepreneurs along the way place members on the board and help, uh, develop the technology. So, for example, um, Dell Technologies Capital led the series B funding for Zscaler. Obviously, Zscaler was a very successful, uh, disruptor in the network security space.

Uh, and we still have individuals on the board of directors for Zscaler. Uh, another example of Dell Technologies Capital Good work was our, uh, funding of a company called eo. Uh, EO had a very interesting way of doing, um, uh, data storage at a petabyte scale using, uh, an index list methodology of retrieval.

So it was very fast, and we ultimately, uh, led that organization being acquired by CrowdStrike, which is now the foundation of the CrowdStrike Falcon platform. So if you ever hear them talk about their next gen sim or, uh, their Raptor release or log scale, uh, that was a technology that, uh, Dell invested in early on and helped develop that was ultimately acquired and incorporated into that fabric, right? So that's a little bit around, uh, just kind of Dell's pedigree.

Even though we're not always front and center, uh, we are helping, uh, kind of the space, you know, move along. Um, the way I look at this is, um, you know, the math is on the side of the adversary. Uh, we have to be right as defenders a hundred percent of the time.

They only have to be right once, uh, I think Mike Tyson said it well too, which is everybody has a plan until they get hit in the mouth. Uh, but net net is we build our capabilities around threat modeling, not just based on what has happened, but what could happen that way when what could happen can manifest, uh, we are not caught flatfooted. And so, for example, um, Dell has been building in, uh, below the os uh, security validation and telemetry in all of our servers and client devices since 2016.

And it was actually, uh, just about four weeks ago that, um, some, uh, research coming out of Google Project Zero in hacking CPU micro code was used to develop ransomware that ran in the CPU. Um, it was, uh, not too long ago that Black Lotus, uh, made the news as being the first, uh, firmware level, uh, uh, boot kit available for sale on the dark web. So capabilities that typically, uh, were limited to nation states and very high skilled, uh, threat actors became available for anybody with a few hundred dollars and a desire to cost some mayhem, right?

And so, uh, part of what we do is, uh, providing customers the ability to, um, not just trust what's coming out of our factories, but validate it continuously. Um, part of what we do is on all of our commercial client PCs, we provide a dedicated, uh, hardware container for secret storage and credential storage. Uh, so that way your secrets are not saved in the same place of which the data of the secret you're trying to keep is residing.

'cause you don't want your keys in your lock in the same place. Uh, as well as, um, owning our part of a customer's security, uh, posture, which is, um, understanding everything that happened to that device up until the point that your security tools were running. Uh, because, um, if you think about it, your computer is doing a lot, uh, before your security tools are ever providing any sort of data to you, right?

It's loading code, uh, potentially it has a network stack at that level. There might be drivers at their level. If you've ever built a computer and you took pieces off a shelf and they just sort of work, that should tell you that there's an exchange of information between all of those different components.

And whenever there's a, an exchange of information, you need to consider the trust boundary and how you manage that handoff between components, right? So what we do is we start with a secure foundation, and that's gonna be with our, uh, hardware and software supply chain. Um, then we move on to, uh, secure implementation of components that we're getting from our providers.

Uh, and that's gonna be our relationships with, uh, the various semiconductor designers and manufacturers and the capabilities that we built to extend their native capabilities. Then we add on the, uh, integration between the hardware and the software tools that a customer's already using. And this is key to our strategy because rather than providing a customer, uh, a Dell console with, uh, a Dell product, what we're doing is we're taking the data that only we have as a technology partner, and we're meeting the customer where they are and the tools that they're already using, so that we're kind of democratizing the access to this level of data where your security teams and doing everything we can to make it easy.

Um, over here we're gonna step through some of the things that we do kind of individually. Um, so the first piece, uh, is our, uh, secure supply chain or our hardware supply chain. Uh, to give you some very tactical examples, uh, Dell holds our suppliers and our sub tier suppliers to the same standards that Dell holds itself to, and we audit to that.

Uh, additionally, uh, within our manufacturing facilities, we have a ability to extend our hardware security, uh, modules so that we're able to manage the attestation devices during manufacture. Um, we also, when we're delivering devices to a customer, uh, have touchpoints where we are, uh, looking at the firmware of that device and the component of that device, and inspecting, uh, what was manufactured, uh, in our manufacturing lines. So for example, um, when a device is getting shipped to a client, uh, it will, uh, arrive from manufacturing, uh, in the, um, uh, main facility for that region.

Uh, it'll get, uh, disassembled and then, um, analyzed by a Dell employee, uh, and, uh, tested against the components that actually made that device. Um, we can do that because we also, uh, maintain, um, an inventory of our unique piece part identifiers. So you can think of that in terms of traceability.

Um, and then what I'm really proud of is Dell will provide this hardware bill of materials, but also a full software bill of materials to any customer who asks for it, right? So if a customer comes to me and says, Hey, your Dell code is developed by you in inherent to your standards, but you built that code out of something that might have been built out of something else, give me that bill of materials so that I know what this code is made out of. They will actually do that, and not everybody will do that in this space.

Um, the next capability is gonna focus on some of our, uh, integrations with our, uh, silicon partners. Um, I'm specifically going to highlight Intel, but Dell is also silicon agnostic. So I'll point out what features and capabilities exist in our A MD solutions, uh, as well as, uh, where applicable are ARM-based Qualcomm solutions.

However, what I would submit is that Intel is very mature from a security perspective. And so, uh, their capabilities, uh, are, uh, more advanced, uh, in terms of what they're providing us to be able to implement to provide, uh, a more secure, uh, outcome for a customer. And for example, um, within Intel's vPro architecture, there's, uh, something called the Intel Threat Detection Technology.

And basically what this does is this allows us to, uh, provide hardware level memory data to your endpoint security solution. So your defender or your CrowdStrike. And the reason why that's really important is if you don't have hardware level data from the CPU of what's going on in your memory, then, uh, you're getting that data typically from the operating system and the kernel, which is oftentimes what has already been compromised.

And so by moving that source of truth lower, uh, to, you know, ring negative one, uh, we are basically able to provide a better visibility of the non-volatile space of a device, uh, to different security products. Now, one of the other, So Justin, yes, Jack Poller here. Um, so you're talking about providing that information to the security tools.

What's the capability for an end user deploying Dell hardware or an end user being an IT user, right, to, uh, validate the provenance of, say the firmware? Great question. So if we move up a stack, um, one of the capabilities that we do is an off host, uh, firmware verification.

So, um, Dell has an application called Dell trusted device. It's also integrated into our unified, uh, client device manager, uh, called the Dell Client Device Manager. So there's two ways to consume it, either as our single agent for manageability and security, or as an explicit security service.

And not only is the Dell device doing its own validation based off of the cryptographic key stored in our Dell embedded controller in alignment to, um, uh, NIST 800, uh, 1 47 I believe, or 1 74, I always flip that up. Um, but after that device posts, uh, we then, uh, in our driver look at the firmware image that, uh, loaded that operating system and all your security tools, and then we communicate that out to, uh, Dell's repository so that you can compare the baseline of what booted your device. Um, and hopefully that answers your question, which is, um, we're doing the verification during the boot process using our hardware route of trust, but we're not just trusting that device to tell you that it's pristine.

Uh, so we also have a driver that will then, uh, take that image and communicate that out to Dell and let you know if there's a variance in that baseline. Does that help? Yes.

Do you, do you have the ability to do that from out of band management like your, your server board management? Uh, so what I'm talking about is specifically around, uh, clients on servers. You're able to do this through idr.

So yeah, that would be done through outof van management. On the topic of Outof van management, though, one of the other unique capabilities that we have is, uh, a patent on Intel management engine verification, because sometimes when I talk about vPro, um, security professionals will remember the fact that it is, is out of band management, and it's a very mature technology, which means it's, uh, been vetted and had various flaws and fixes presented over the years. And so, on that note, not only does Dell validate our own code and our firmware validation, but, uh, one of our capabilities on Intel chips is we actually do a validation of the Intel management engine as well.

Uh, since the, uh, Intel vPro out of band management stack is essentially a full computer, uh, operating in parallel to your compute environment. Um, so again, you're asked a specific question, which is servers for servers. We're doing that via our idr uh, capability.

Uh, but then it's a very good question, which kind of brings up the whole idea of, hey, vPro is not just security features, it's also out ofAnd management. Uh, how is Dell helping harden that? And that's where we're not just looking at Dell's firmware code, but we're comparing that Intel management engine to the baseline that we maintain, uh, in our repository.

Um, so moving on, um, after talking about the Intel threat defense technology, which, uh, makes your security tools faster, and then also can give your security tools more data. And then I talked a little bit about how Dell secures Intel as well. Um, we come up into, uh, some of the capabilities that we have, um, that where we're handing trust back to Dell.

So we start with the Intel, um, uh, or the Dell embedded controller to bootstrap your Intel processor. Then we hand the, uh, trust back to Dell, EFI to then load windows and your security tools. And so, um, within that we have a few interesting capabilities.

One of our other patents is on this concept of, uh, bios, indicators of attack. You can think about that like EDR running below your operating system. And so where firmware verification is a static comparison to a baseline, um, the indicators of attack are configuration changes and management changes that weaken the posture of that device, uh, that we're able to then highlight, uh, to a customer, uh, so that they know when somebody's weakened the security of the platform.

Um, another capability that, uh, I think is really interesting is at the same time that we're doing that firmware verification off host, uh, we are also, uh, doing a check of that firmware image against our Dell security advisories for our CVE database. Uh, Dell obviously does, uh, have the ability to, uh, publish our own, uh, CVE numbers. We're, uh, one of those individuals.

Um, but to make things really simple, when a customer does this check, uh, we'll say, yeah, that's my code. I wrote it. And you can trust the foundation at which your security, uh, tools are sitting upon, because I did both the static and dynamic analysis of it.

But also, by the way, that particular version has a, uh, known weakness for it. Here's the weakness, and we want you to go ahead and patch and remediate that. Not talking about manageability today, but Dell has, uh, mature capabilities around management where we cannot just highlight, uh, the fix from a security perspective, but then help a customer implement that fix, whether it's out of band, whether it's integrated into Intune, or whether it's using, uh, dedicated Dell apps.

Um, another capability I wanna highlight is, uh, in the concept of incident response. So earlier I got a question around like, what makes Dell more secure, uh, and where that claim came from. And hopefully you're seeing that, for example, it's not just our hardware root of trust, but it's also our off host validation as a detective control and our indicators of attack as an auditing control.

Uh, and then when we come to, uh, our firmware image capture, um, in the event that the baseline that loaded your, uh, device operating system and security tools wasn't what Dell wrote, um, we also have the ability to, uh, dump out that firmware, uh, in the, uh, devices file system so that it can be collected by your incident responders or by Dell. And that's actually really important because from an electrical engineering perspective, not only does Dell build in like chassis intrusion onto our devices so that you can tell if somebody opens it up, but if you try to take a chip clip and put it on the, uh, spy flash memory chip on a Dell device, the way we ground that chip, uh, you actually wouldn't be able to, to do a brute force image capture using traditional methods, right? And so that's why we had to build this software pipeline where, you know, hey, once a customer identifies a problem at this level, what do they do about it?

How, how can they start that incident response process? And Adam will probably, I'll, I'll hand the floor over to him for a second to talk about how we can kind of help with that. Um, and then the next piece is, okay, so I've told you that we're able to provide, um, our hardware bill of materials in the form of, uh, a cryptographic certificate that you can validate, uh, using either the Dell trusted device app, or you can do it in an air gap way using, uh, the NSA hers tool.

Um, and then I told you that Dell will also provide a customer the software bill of materials. Uh, and then I've taken you through this process of a Dell commercial PC booting, which is, uh, the Dell embedded controller, uh, loading, uh, using our, um, cryptographic key bootstrapping intel with Dell, then validating and doing an off host verification of Intel. But then also, um, not verifying just the Dell firmware, but recording a log of firmware changes over time to build that EDR database below the operating system.

Uh, and then also, of course, uh, being able to allow you to, to capture forensic data if there were any attacks detected, uh, and tell you if there are any vulnerabilities. But then this last piece is how do I get the data to a client? How do I get the data to a security team?

And so what our strategy has been, uh, has been to, uh, integrate with technology that customers are already using today. So I mentioned earlier that Dell has the Dell trusted device driver, and we also have the Dell, uh, uh, client device manager app, which is our unified agent for management and security. Um, and a customer could just use those if they wanted to.

Um, they could grab this data with their existing security tools like Tanium or whatever endpoint control they wanted. Um, but what we've done is we've built very easy paths so that, um, rather than having to build that integration yourself, uh, we have, uh, direct integration into Microsoft Intune so that a customer can build, uh, basically a device policy check against all the data that Dell is providing. And I've had some clients actually use that as part of their autopilot and provisioning to help, uh, you know, operationalize some of the scoring and the data that we provide in their decisions, uh, for a device being trusted or not.

Um, we've also built that capability in, uh, absolute. So if you're not familiar with absolute, absolute originally started as, uh, basically device tracking. So it's, uh, essentially kind of a digital tether to your firmware operating system.

It does a lot more than that today. Uh, but we built and integrated the, uh, data for, uh, Dell's, uh, firmware security into absolute. And that means that a customer can purchase a Dell device that's been factory activated with absolute, where they don't need to do anything to turn it on.

And, uh, that, uh, technology will let them know where the device is, know what security tools are running, and then also give them the Dell data that we're providing below the operating system. And then the last major integration is we've, uh, integrated it directly into, uh, CrowdStrike Falcon. And so not only can a customer come to Dell and say, Hey, I need a pc and I want that PC to include, uh, CrowdStrike Falcon out of the factory.

And we will do that. But if the customer's already leveraging the CrowdStrike Falcon platform, um, they can, uh, leverage the native integrations where in the, uh, CrowdStrike platform, they can mix their hardware and supply chain security data with their application and operating system data, uh, and drive security outcomes. And by putting all that data in one spot and not gating it behind a subscription or a cost, and meeting the customer in the tools that they're already using, it's our perspective that they're more likely to use this data and ultimately be safer.

Um, so I'll pause 'cause I just went through basically the stack in pretty granular detail. Um, any questions, uh, about, uh, anything at this point? Yeah, uh, hi Justin, this is Tyler Christensen.

I had a, you mentioned you started this whole thing off with, um, you know, you, the adversarial only has to be right once, um, mm-hmm. And the customer kind of has to be right a lot of the time. Um, I, I appreciate the story and the integrations.

Um, what are your commitments to the customer though it, the, uh, process of you always have to be right? Yeah. Um, so that's actually a deceptively big question.

One in which I would point you to our policies around, uh, uh, vulnerability disclosure and vulnerability management. Um, we could do a full day on our product security and incident response team and how Dell does, uh, vulnerability management and the components that we're building our software. com forge slash security, where a lot of those policies are, are laid out and, uh, documented.

Um, and then that actually might be a good opportunity to introduce Adam, uh, to talk about, um, where not only are we, um, you know, doing these capabilities for a customer to use, but in a lot of cases we're actually like using these capabilities for a customer on their behalf. So, uh, it, it is a great question. Ultimately, we are limited by being able to control what we can control, uh, but hopefully you see the different points where we're not just establishing controls, but providing data and giving a customer the ability to prove, uh, Providence.

Um, and then from there, um, Adam, if you want to kind of speak up in terms of where and how our services team, uh, are using some of these, uh, capabilities to kind of help customers who, uh, aren't used to thinking it's security in these terms. Certainly. Thanks Justin.

Um, yeah, ma many of our customers are, are kind of in this, uh, mode of two different ways, right? Like, they have either made some significant investments in their security teams and they're taking our technologies and kind of bringing that into what they're already doing. Or they're asking us to step in as the managed security services provider in order to manage, you know, some of those instances for them.

Um, we are predominantly focused on, uh, you know, meantime to detect, meantime to respond, you know, the common one that you see there and the reduction of those as opposed to, um, dedicated, uh, service level agreements. Um, yeah. So, uh, I guess the, the other piece is, uh, Adam, just to kind of highlight, um, in addition to a customer being able to call depro support when they have an event and being able to get our help with, um, uh, you know, re using some of these tools or, uh, atching the firmware, or in the case of, uh, the hardware bill of materials check, which we were call secured component verification, getting a device exchanged, right?

Getting a new device, um, that, uh, will pass that validation. Um, one of the other, uh, capabilities that we have, uh, is our incident response and recovery team. And so, um, not only does Dell provide like technical controls, like self-healing, image recovery, where a Dell device can actually, uh, rebuild itself, um, from the platform up.

But we have, uh, teams that are trained in doing, uh, forensic analysis of the data that Dell's providing, uh, and can help a customer do the types of, uh, physical and digital, uh, investigations, uh, for these types of threat, right? Um, one other piece is we're gonna talk a little bit around, uh, you know, some of our services throughout the conversation, but if a customer acquires a Dell PC and is using, um, some of the security tools that we manage in our customer security operations center, we actually, uh, manage and monitor this hardware level data coming out of the Dell pc in addition to all the other data that is coming out in our customer security operations center. So what does that mean?

Um, can you hire Dell Technologies to do incident response and recovery on our competitors' products and solutions and cloud? Yes. And a lot of customers do.

Um, can you, uh, hire Dell's, uh, uh, customer Security operations center to provide managed security services on a device that Dell didn't manufacture? The answer is yes, a lot of customers do. But since we designed and, and created these products and we have, uh, a little bit more of an intimate understanding of, uh, the capabilities in those products, our customer security operations center also uses that to operationalize, um, these benefits for a customer, right?

Um, so that, that's, uh, hopefully, we'll, we'll give you some idea. And I, I do want to pause, 'cause that was a really great question earlier, which was, you know, what, what sort of commitments does they'll have? What sort of, uh, policies do they have?

And, and like I said, they're unfortunately, and fortunately very well thought out and very detailed, uh, too detailed for me to have in my brain at one point simultaneously to answer. Um, um, and of course, hopefully you see that one of our ethoses is to provide transparency, which is ultimately like if we're doing things with best practice in mind and then providing transparency, uh, in the form of telemetry, uh, hardware bill materials, software bill, materials integration, you can kind of see where that comes in. And then if a customer needs help, we'll actually use these capabilities for them.

But I just want to, uh, give an opportunity to make sure that, you know, we did address, uh, the question and I understood the question before we kind of move forward. Uh, yeah, all good from my side. Thank you, Justin.

Okay, awesome. Um, so this is just how we articulate our capabilities to a customer. Um, so, uh, the way we frame this is, uh, we break up built with, built in, uh, built on, uh, so built with, again, uh, our, our capabilities of what we made your technology out of, but then also how we transported the device to you.

So that could be, um, uh, tamper protection, uh, or tamper detection seals on the, the box or the pallet, um, that could be doing a, a nist, uh, uh, wipe or sanitization of the drive, and then re-imaging that drive in our local facility, uh, staffed by citizens of the local country. Um, and then that's also in the form of like our, uh, hardware component verification. We'll, we'll give you that cryptographic certificate so that you can, uh, measure the baseline of what you got and then, uh, if there's a variance, um, you know that what you received wasn't what we manufactured.

And at that point, you can call us, we'll get you a new device, and we'll begin our, uh, product security incident response process. Um, I also explained our built in is, uh, two components. One is the, uh, Dell, uh, safe bios architecture, which is all the capabilities I mentioned, which is collecting that runtime security data below the operating system before your security tools are running, and then handing that over to the tools that you're already using.

Uh, and then the other component we refer to as Safe id, that is the, uh, dedicated hardware based credential storage or secret storage that comes on all of our Dell commercial devices, uh, which, uh, is per the Trusted computing group, the, uh, most secure way to manage secrets, as you know, having kind of a dedicated, uh, hardware security module and device to be able to, to, to store and, and compute those. Uh, and so that's something that we do on all Dell commercial PCs. And then finally, the built on is the integration with our, uh, vetted and list of software partners like Microsoft Crowds, CrowdStrike.

Um, again, though, like I said, the way we built and implemented this, a customer could do the same thing with Splunk or, or Palo Alto. They would just have to put forward a little bit more effort than what we've got kind of out of the box. Uh, and then finally, if a customer says, Justin, that's all great, but I've got my hands full with phishing emails.

Um, I understand that this is a threat, but I'm got my hands full managing the risks that I knew about before I talked to you, then I can say, well, that's all right because I've got Adam's team and Arun team, uh, and, uh, we'll actually use all these on your behalf for you. Right? Um, and so, uh, that is essentially, um, you know, everything I was asked to kind of go through.

Um, here's, uh, an example of the third party at the station from Principal Technologies. Um, this is just kind of a recap of our strategy, which is taking data that only we have and, uh, meeting the customer where they are and doing that without the customer having to buy anything, right? So if you just get a Dell Commercial pc, you just have these things.

Um, we've provided these to customers on all of our servers and our clients since 2016. You don't need to go buy a product to do this. You just need to, to know and, and utilize the capabilities.

And, uh, like I said, if, if that's a gap, we'll actually do that on your behalf. Uh, and then here is, uh, an example of a hands-on lab, uh, that we created to walk a customer through an example of this combined architecture. Um, we also have a lab on the architecture with Microsoft Intune.

We have a lab with our, uh, manages services and what have you.